Splunk App for Wazuh

Splunk App for Splunk offers an option to visualize Wazuh Alerts and API data. Wazuh helps you to gain deeper security visibility into your infrastructure by monitoring hosts at an operating system and application level.

Requirements
  1. You must install the TA Wazuh Connector from our Github Repo. After installed, needs to be configured.
  2. Also, you need to install and setup a Splunk Universal Forwarder where the Wazuh's manager is installed.
  3. A Wazuh Manager with access to the API via HTTP (usually on port 55000).
  4. User and password (credentials) for api basic authentication (usually foo and bar)
  5. Set the indexers to manager receiving. (Check bottom).
Quick Install
Splunk Servers
  1. Create a new index named wazuh_api.
  2. Install the TA Wazuh API Connector on each indexer.
  3. Install our app SplunkAppForWazuh on each search head that you have.
  4. On Splunk, Go to Settings --> Data Inputs and edit the four new local inputs with prefix wazuh* one by one (Remember to use your API URL and API credentials).

    Repeat the process on each Data input (four in total).

  5. Wait a couple of minutes to have data in your wazuh_api index.

Wazuh Manager
  1. You must install Splunk Forwarder on your Wazuh Manager.
  2. Go to $SPLUNK_HOME/etc/system/local.
  3. Edit the file inputs.conf:

    [monitor:///var/ossec/logs/alerts/alerts.json]
    disabled = 0
    host = wazuhmanager
    index = wazuh
    sourcetype = wazuh
  4. Edit the file and add the following stanza on props.conf:

    [wazuh]
    DATETIME_CONFIG =
    INDEXED_EXTRACTIONS = json
    KV_MODE = none
    NO_BINARY_CHECK = true
    category = Application
    disabled = false
    pulldown_type = true
  5. Point the output to the Wazuh's Indexer (or indexers): $SPLUNK_HOME/bin/splunk add forward-server <host name or ip address>:<listening port>

  6. Restart Splunk services (Windows Service, Linux).

  7. Test on Splunk: index=wazuh *

Setup Manager Receiving
  1. Log into the receiver as admin or an administrative equivalent.
  2. Click Settings > Forwarding and receiving.
  3. At Configure receiving, click Add new.
  4. Specify the TCP port you want the receiver to listen on (the listening port, also known as the receiving port). For example, if you enter "9997," the receiver listens for connections from forwarders on port 9997. You can specify any unused port. You can use a tool like netstat to determine what ports are available on your system. Make sure the port you select is not in use by splunkweb or splunkd.
  5. Click Save. Splunk software starts listening for incoming data on the port you specified.

    More info at Splunk Documentation

More info

Check our Github Repo.